Cost
The entire governance stack runs at $0/month by using only free Azure services — and by deliberately avoiding the one paid feature that would otherwise be tempting.
Monthly target
$0
Budget alert
$2
Azure Cost Management
Log Analytics allowance
5 GB
free per month
Service breakdown
| Service | Cost | Note |
|---|---|---|
| Azure Arc control plane | Free | inventory, RBAC, tagging, policy evaluation |
| Azure Policy (resource-level) | Free | definitions, assignments, evaluation |
| Azure Update Manager | Free | patch assessment + scheduled patching |
| Log Analytics | Free ≤5 GB/month | workspace arc-hybrid-lab-ws |
| OS security audit (Lynis) | Free | open-source, replaces paid Machine Configuration |
| CIS hardening (Ansible) | Free | ansible-lockdown role |
| CI/CD (GitHub Actions) | Free | public repo, OIDC auth |
| Hosting (Azure Static Web Apps) | Free | static site + custom domain |
| Networking (Tailscale) | Free | mesh VPN (personal tier) |
| Machine Configuration excluded | Not used | $6/server/month — excluded to keep $0 |
The one optional cost
| Azure VM (B1ls) | ~$2/month | hybrid networking (M9), deallocated when idle |